Skip to content

Instantly share code, notes, and snippets.

@devtooligan
devtooligan / cursedbeaconproxy.sol
Last active April 9, 2024 16:10
PoC of crit bug found in Astaria.xyz's custom BeaconProxy contract
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;
import "forge-std/Test.sol";
contract SheHateMe {
receive() external payable {}
function getImpl(uint8 x) public returns (address) {
return address(this);

Do you write smart contracts? Want them to be safe and efficient? Read on!

The state of smart contract languages could historically be categorized as lacking constructs that drive programmers to write safe code and being inefficient due to poor optimizations. Oftentimes, programmers write lower level code riddled with footguns in pursuit of gas savings. What if safety and efficiency weren’t at odds?

Here’s how we can eliminate an entire class of bugs without spending an exorbitant amount of gas on safety checks thanks to EIP-1153!

For example, take the following smart contract (Figure 1) which exhibits “read-only reentrancy”. Currently, nothing prevents the following call sequence from succeeding despite there being ambiguity about what value will be returned by DataRace.price during call sequence, X.

Callstack [DataRace.withdraw, msg.sender, X, token.transfer]

  • Panoramix is probably the most well-known one thanks to etherscan.io integrating it. It'll return "python-like" code that is actually quite nice to read. Unfortunately it often ends up having "timeouts" causing the decompiled code to just abruptly stop.
  • Dedaub's Decompiler is my personal favorite. When it produces something, it does produce "solidity-like" code that is well readable. But sometimes it just fails to yield anything at all. And even when it does work it struggles whenever memory handling gets involved, requiring some educated guessing.
  • ethervm.io's Decompiler is another online service which similar to Panoramix always delivers a result, but it also has the tendency to skip big parts of the code due to "could not resolve jump destination" errors and the like.
  • Heimdall does not have an online s
@fiveoutofnine
fiveoutofnine / PrintIdenticon.s.sol
Last active February 17, 2023 02:24
A script to generate and print identicons.
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;
import { Script } from "forge-std/Script.sol";
import { console } from "forge-std/Test.sol";
import { LibString } from "solmate/utils/LibString.sol";
/// @title Script to generate and print an identicon.
/// @author fiveoutofnine
/// @dev To run the script, run the following commands:

When is the next bootcamp gonna start?

TL;DR: It's running! It's online! You can start right away! Check #participate for details!

Confused? Well, let me explain...

The Secureum Bootcamp started out in October 2021 with "Epoch 0" and was divided into LEARN and CARE phase. The LEARN phase ran for 8 weeks and each week had its own "slot". Learning materials for each slot was released week by week and later tested in quizzes.

In December, the 128 best scoring participants (from 1024 total participants) were invited to the CARE phase. Each participant was randomly assigned to one of four projects that partnered up with Secureum for an "audit-like" contest. During this contest participants would review the project's provided code (as one would during an audit) and provide a report of any findings which were aggregated into a single big report in the end.

@devtooligan
devtooligan / importVSCodeSettings.sh
Last active October 20, 2022 11:15
importVSCodeSettings
# This is a bash function that will copy a vscode settings.json file into the current directory and randomly select a color scheme.
# Step 1: Create a settting.json file somewhere which at least contains this section. Feel free to add your favorite settings to this.
{
"workbench.colorCustomizations": {
"titleBar.activeForeground": "FOREGROUND",
"titleBar.inactiveForeground": "FOREGROUND",
"titleBar.activeBackground": "BACKGROUND",
"titleBar.inactiveBackground": "BACKGROUND"
@Tofunmi1
Tofunmi1 / README.md
Created July 31, 2022 20:22
Bubble sort algorithm in yul

Recursive Implementation Of Bubble Sort in solidity and yul

***credit -> geekforgeeks -> https://www.geeksforgeeks.org/bubble-sort/

The idea is to place the largest element at their position and keep doing the same for every other elements.

Approach:

Place the largest element at their position, this operation makes sure that first largest element will be placed at the end of array. Recursively call for rest n – 1 elements with same operation and placing the next greater element at their position. Base condition for this recursion call would be, when number of elements in the array becomes 0 or 1 then, simply return (as they are already sorted).

# ▇ => ▇ + ▇
# Minimal runtime bytecode for a contract that mutates
# into two child contracts and then self-destructs
# 1st child contract receives the call value
# 2nd child contract recevies the remaining balance
# author: Saw-mon and Natalie
# constructor payload for the spawned contract
# ┏━━━━━━━━━━━━━━━━━━━ push1 RUNTIME_BYTECODE_LEN # L
@emo-eth
emo-eth / chain_funcs.sh
Last active June 22, 2023 14:43
Helper functions for interacting with chains and Foundry tests. Source from .zshrc etc
###########
# Imports #
###########
# the RPCs file should include RPC URLs and Etherscan API Keys for relevant networks
# (in a separate file so they don't get committed)
source "$(dirname "$0")/rpcs.sh"
# any useful addresses for various networks for easy reference
source "$(dirname "$0")/addresses.sh"
# any useful functions and definitions for interacting with Seaport
@brockelmore
brockelmore / NotSoPrivateFn.sol
Created February 7, 2022 06:53
Accessing private function outside of the contract
// SPDX-License-Identifier: UNLICENSE
pragma solidity >=0.8.0 <0.9.0;
contract Private {
function t_() private returns (uint256) {
return 1;
}
function rt() public returns (bytes32 fp) {